System and method for end-to-end communications tracing

ABSTRACT

A method for tracing communications includes receiving trace criteria from a first remote element and determining whether a call signaling message matches the trace criteria. The method includes attaching a trace tag to the call signaling message, if the call signaling message matches the trace criteria. The method further includes transmitting the call signaling message to a second remote element.

TECHNICAL FIELD OF THE INVENTION

This invention relates in general to telecommunications and, moreparticularly, to a system and method for diagnostic call tracing.

BACKGROUND OF THE INVENTION

Modern communication networks often employ highly distributed controlfunctions that utilize a variety of signaling protocols. Diverse,distributed networks may allow for greater scalability and flexibilityin providing communication services. Protocol diversity anddecentralized signaling architectures, however, complicatetroubleshooting of configuration errors, software bugs, and hardwarefaults. Call logging and other forms of reporting may be used toidentify and locate problems within a network

Within a particular network, however, multiple problems may existconcurrently. Furthermore, the integration of various administrativedomains within the network, such as intra-enterprise, inter-enterprise,and service provider domains, with differing troubleshootingrequirements, may create difficulties in implementing a single, uniformprocedure for call reporting. Additionally, unnecessary call tracing andreporting may impair debugging by obscuring useful information and maydegrade call processing by utilizing valuable network resources.

SUMMARY OF THE INVENTION

In accordance with the present invention, the disadvantages and problemsassociated with telephony filtering have been substantially reduced oreliminated. In particular, a method and system are provided forcommunicating a tracing status of a call to a plurality of nodes and ofcollecting tracing information from the nodes.

In accordance with one embodiment of the present invention, a method fortracing communications includes receiving trace criteria from a firstremote element and determining whether a call signaling message matchesthe trace criteria. The method includes attaching a trace tag to thecall signaling message, if the call signaling message matches the tracecriteria. The method further includes transmitting the call signalingmessage to a second remote element.

In accordance with another embodiment of the present invention, a methodfor tracing communications includes receiving a call signaling messageand determining whether the call signaling message includes a trace tag.The method further includes transmitting a trace report to a remoteelement, if the call signaling message includes a trace tag.

Technical advantages of certain embodiments of the present inventioninclude an improved method of communicating requests for tracingservices and propagating tracing services reports in a distributed,multi-protocol network. Other technical advantages of certainembodiments of the present invention include the ability to correlatecaptured information on a per call basis to facilitate analysis, totailor filtering criteria to limit unnecessary reporting, and tooptimize the type of information that is reported for filtered calls.

Other technical advantages of the present invention will be readilyapparent to one skilled in the art from the following figures,descriptions, and claims. Moreover, while specific advantages have beenenumerated above, various embodiments may include all, some, or none ofthe enumerated advantages.

BRIEF DESCRIPTION OF THE DRAWINGS

For a more complete understanding of the present invention and itsadvantages, reference is now made to the following description, taken inconjunction with the accompanying drawings, in which:

FIG. 1 illustrates a communication system according to a particularembodiment;

FIG. 2 is a block diagram showing contents of a management nodeaccording to a particular embodiment;

FIG. 3 illustrates contents of a trace trigger request according to aparticular embodiment;

FIG. 4 illustrates contents of a trace tag according to a particularembodiment;

FIG. 5 is a block diagram showing contents of a tracing node accordingto a particular embodiment;

FIG. 6 illustrates contents of a trace report according to a particularembodiment;

FIG. 7 is a flowchart illustrating operation a particular embodiment ofthe tracing node; and

FIG. 8 is a flowchart further illustrating operation of a particularembodiment of the tracing node.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1 illustrates a communication system 10, according to a particularembodiment. Communication system 10 includes endpoints 20, tracing nodes30, nodes 35, and a management node 40. Tracing nodes 30 and nodes 35support communication between endpoints 20 by transmitting callsignaling messages 50 along a path between endpoints 20. Tracing nodes30 and nodes 35 may convey call signaling message 50 on one of multipleprotocol paths connecting any two nodes. During operation, managementnode 40 may request the tracing of calls matching specified criteria.Management node 40 specifies the trace criteria in trace triggerrequests sent by the management node 40 to one or more tracing nodes 30.Tracing nodes 30 compare the contents of call signaling message 50 tospecified trace criteria included in trace trigger request 70. When thetrace criteria matches, the relevant tracing node 30 transmits a tracetag 75 embedded in trace trigger request 70 to other tracing nodes 30.Other tracing nodes 30 may then provide tracing information to adesignated management node 40 upon receiving a call signaling message 50that includes the transmitted trace tag 70. Tracing nodes 30, uponreceipt of trace tag 75, may report to a designated reporting address,such as a particular management node 50 specified by trace tag 75,diagnostic information specified by trace trigger request 70, such assignaling protocol messages of a particular type or types or diagnostictrace information for a specified level of detail, in a trace report 80.

By providing an effective process for propagating trace tag 70 along apath associated with call signaling message 50, communication system 10may enable end-to-end session tracing in a highly distributed,multi-protocol environment. In particular embodiments, communicationsystem 10 may provide detailed control of tracing and reportingperformed by tracing nodes 30 and, as a result, may limit performancedegradation and network load resulting from the tracing and reporting.Additionally, by facilitating the tunneling of trace trigger requests 70and trace reports 80 within control signal messages 50, particularembodiments of communication system 10 may provide a method for tracingand reporting that can operate despite the presence of nodes 35 that donot support the described trace request messages or trace reportingfunctionality.

Endpoints 20 may be any combination of hardware, software, and/orencoded logic that provides communication services to a user. Forexample, endpoints 20 may include a telephone, a computer runningtelephony software, a video monitor, a camera, or any othercommunication hardware, software, and/or encoded logic that supports thecommunication of packets of media (or frames) using communication system10. In a particular embodiment, endpoints 20 represent Internet Protocol(IP) telephones. Endpoints 20 may also include unattended or automatedsystems, gateways, other intermediate components, or other devices thatcan establish media sessions. Although FIG. 1 illustrates a particularnumber and configuration of endpoints 20, communication system 10contemplates any number or arrangement of such components to supportcommunications of media.

Tracing nodes 30 and nodes 35 couple to other tracing nodes 30 and/ornodes 35 and are capable of creating transmission paths to route callsbetween endpoints 20. More specifically, tracing nodes 30 and nodes 35may be capable of receiving call signaling messages 50 and performingcall setup and other call control functions based on call signalingmessage 50. Tracing nodes 30 are additionally capable of tracing callsignaling messages 50 associated with calls transmitted on communicationsystem 10, propagating trace tags 70 received from management node 40 orextracted from trace trigger requests 70 to other tracing nodes 30, andreporting information related to these calls to management node 40.

Nodes 35 may lack the capability to respond to tracing requests, tomodify call signaling messages 50, and/or to perform reporting.Although, for the purposes of illustrating particular capabilities oftracing nodes 30 operating in mixed systems, FIG. 1 illustrates anembodiment of communication system 10 that includes nodes 35 incapableof providing the described tracing and reporting functionality, aparticular embodiment of communication system 10 may include none, oneor multiple nodes 35. Alternatively, any or all telephony nodes in aparticular embodiment of communication system 10 may represent tracingnodes 30.

Management node 40 facilitates interaction between an administrator or amanagement device and tracing nodes 30. Management node 40 generatestrace trigger requests, based on input from a user or other managementdevice, and provides tracing information to the user or managementdevice, based on tracing reports collected from tracing nodes 30. Ifcommunication system 10 is configured to respond to requests from ahuman administrator or other user, management node 40 may include userinterface components, such as a keyboard, mouse, and/or monitor, tofacilitate interaction between the user and management node 40.

In general, tracing nodes 30, nodes 35, and management node 40 mayinclude any combination of network components, gatekeepers, mediagateway controllers, softswitches, IP PBXs, call managers, SIP proxyservers, routers, bridges, hubs, switches, gateways, endpoints,telephony interfaces, IP interfaces, digital signal processors,protocols, voice routing modules, or call control modules, and/or anyother suitable hardware, software, or embedded logic implementing anynumber of communication protocols that allow for the exchange of data incommunication system 10. Although this description focuses, for thepurpose of illustration, on particular embodiments of communicationsystem 10 that propagate trace tag 75 on the call control layer,alternative embodiments of communication system 10 may propagate tracetag 75 on the bearer control layer, the application layer, devicecontrol layer, and/or the media inside bearer layer.

In a particular embodiment, tracing nodes 30, nodes 35, and managementnode 40 may represent Voice over IP (“VoIP”) components. As noted above,management node 40 may include user interface components, such as akeyboard, mouse, and/or monitor to allow a user to interact withmanagement node 40. Additionally, in a particular embodiment, managementnode 40 may represent non-telephony components, such as servers,networked personal computers (PCs), or any other suitable computingdevice.

In operation, tracing node 30 determines a trace status of a callsignaling message 50 passing through trace node 30. Call signalingmessage 50 may represent any appropriate signaling message associatedwith a call established or a call to be established on communicationsystem 10. The “call” may represent any suitable communication session,dialog, and/or other suitable form of connection and may include audioand/or video and/or animation and/or holography signals, data, ormessages transmitted through voice devices, text chat, web sessions,facsimile, instant messaging, e-mail, or any other type of digitalcommunication. In the illustrated embodiment, the call represents avoice call communicated using Voice over IP (VoIP) protocol.

Call signaling message 50 may represent any suitable form of controlmessage or signal corresponding to a signaling protocol supported by oneor more elements of communication system 10 and generated as part of thecall. As noted above, call signaling message 50 may represent asignaling message transmitted on the call control layer, the applicationlayer, and/or the bearer layer. For example if call signaling messages50 represent messages communicated on the call control layer, callsignaling message 50 may specifically represent a Session InitiationProtocol (SIP), an H.323, a Media Gateway Control Protocol (MGCP),Skinny Client Control Protocol (SCCP), Signaling Connection Control Part(SCCP), Bearer Independent Call Control (BICC), Narrowband SignalingSyntax (NSS) format message, or any other suitable form of call controllayer message. If call signaling messages 50 represent messagescommunicated on the application layer, call signaling message 50 mayrepresent a Java Telephony Application Programming Interface (JTAPI),Telephony Application Programming Interface (TAPI), Java APIs forIntegrated Networks (JAIN), Parlay, Intelligent Network ApplicationProtocol (INAP), Advanced Intelligent Network (AIN) message, or anyother suitable form of application layer message. If call signalingmessages 50 represent messages communicated on the bearer layer, callsignaling message 50 may represent a Resource Reservation Protocol(RSVP), or Real-time Transport Control Protocol (RTCP) message, or anyother suitable form of bearer layer message.

Prior to initiation of the call or at any other appropriate point duringoperation, management node 40, in a particular embodiment ofcommunication system 10, activates the tracing functionality ofcommunication system 10 by transmitting a trace activation message 60 toone or more tracing nodes 30. Trace activation message 60 may representany suitable message or signal by which management node 40 may activatetracing functionality in tracing nodes 30. Management node 40 maytransmit trace activation message 60 to all tracing nodes 30 incommunication system 10, to a single tracing node 30 to be propagated toother tracing nodes 30, or to particular tracing nodes 30 configured toreceive trace activation messages 60, depending on the configuration andcharacteristics of communication system 10. In an alternative embodimentof communication system 10, tracing functionality in tracing nodes 30are activated by default. In such an embodiment, management node 40 mayrequest tracing without previously activating tracing functionality oftracing nodes 30.

Once tracing functionality has been activated on communication system10, management node 40 may transmit a trace trigger request 70 to one ormore tracing nodes 30. Trace trigger request 70 may represent anysuitable message or signal by which management node 40 may indicate totracing nodes 30 a desire to trace calls matching specified criteria. Ina particular embodiment, trace trigger request 70 represents anextensible Markup Language (XML) message. FIG. 3 illustrates in greaterdetail the contents of trace trigger request 70 according to aparticular embodiment.

Trace trigger request 70 may include a trace tag 75 that identifiesinformation to be reported and a destination address for trace reports80, such as the address for a particular management node 40. Trace tag75 may represent an XML object or data structured in any otherappropriate format compatible with the signaling protocol of callcontrol message 50 housing trace tag 75. Trace tag 75 may also include arecursive reference to trace trigger request 70 for tunneling the tracerequest through nodes 35. FIG. 4 illustrates in greater detail thecontents of trace tag 75 according to a particular embodiment.

Upon receiving trace trigger request 70, a particular tracing node 30may configure itself to trace calls with call signaling messages 50matching call trace criteria included in trace trigger request 70 andreport any requested signaling and diagnostic information to thespecified destination address of the management node 40. Additionally,particular tracing node 30 may configure tracing node 30 to modifysignaling messages 50, possibly spanning two or more signalingprotocols, to propagate trace tag 75 to other tracing nodes 30. Theoperation of a particular embodiment of tracing node 30 is described ingreater detail with respect to FIG. 5.

As a result, tracing node 30, having received trace tag 75 directly bythe initial trace request 70 or by some signaling protocol with othercomponents of communication system 10, may begin logging informationrequested by trace tag 75 pertaining to the call. At appropriate times,tracing node 30 may generate trace reports 80 that include some or allof the logged information and transmit trace reports 80 to managementnode 40 designated by trace tag 75. Report 80 may be conveyed on one ofmultiple protocol paths connecting tracing nodes 30 to management node40. Tracing node 30 may continue tracing, reporting, and modifying callsignaling messages 50 indefinitely. As described below, trace triggerrequest 70 may additionally include parameters that describe atermination condition for trace trigger request 70 and tracing node 30may terminate tracing, reporting, and modifying if, and when, thetermination condition is satisfied. Furthermore, particular embodimentsof communication system 10 may be configured to allow for deactivationof the tracing functionality by transmitting a trace deactivationmessage (not shown) to one or more tracing nodes 30. The tracedeactivation message may represent any suitable message or signal bywhich management node 40 may deactivate tracing functionality in tracingnodes 30. Management node 40 may transmit the trace deactivation messageto all tracing nodes 30 in communication system 10, to a single tracingnode 30, or to one or more tracing nodes 30 configured to receive tracedeactivation messages, depending on the configuration andcharacteristics of communication system 10.

Thus, particular embodiments of communication system 10 may provide costflexible, scalable, and cost effective methods for call tracing.Furthermore, because trace tag 75 can be tunneled as objects orparameters in conventional signaling protocols and because communicationsystem 10 contemplates tunneling of trace trigger requests 70, elementsof communication system 10 can be integrated with existing communicationsystems and operate in conjunction with components that are notconfigured to provide the described tracing functionality. Additionally,because trace tag 75 includes multiple parameters defining such criteriaas starts times, time-to-live values, and branch counters, communicationsystem 10 provides administrators with a very flexible system that canbe configured to minimize unnecessary network loads and processingdelays and to maximize the effectiveness of information generated duringtracing.

FIG. 2 illustrates the contents and operation of a particular embodimentof management node 40 in greater detail. Management node 40 facilitatesinteraction between an administrator of communication system 10 or amanagement device and tracing nodes 30. Management node 40 includes auser interface 210, a management module 220, a collection module 230, ananalysis module 240, and a memory 250. The administrator or managementdevice requests tracing services through user interface 210 and, inresponse, management node 40 transmits trace trigger request 70 to oneor more tracing nodes 30 through management module 220. Management node40 subsequently receives trace reports 80 from tracing nodes 30 throughcollection module 230, analyzes trace reports using analysis module 240,and provides information from tracing reports 80 to the administrator ormanagement device through user interface 210.

User interface 210 facilitates interaction between an administrator ormanagement device of communication system 10. As indicated above, ifcommunication system 10 is configured to operate with a humanadministrator, user interface 210 may include components to allow theadministrator to interact with management node 40, such as a keyboard,mouse, monitor, printer, or any other components appropriate to allowthe administrator to input information into management node 40 orreceive information from management node 40.

Alternatively, if mobile station 20 is configured to operate with anautomated management device, user interface 210 may include componentsfor interacting with the management device such as a network interface,data port, or other appropriate components. In general, user interface210 receives trace parameters 280 from the administrator or managementdevice and transmits trace parameters 280 to management module 220.Additionally, user interface 210 displays information received in tracereports 80 to the administrator or transmits data from trace reports 80to the management device.

Management module 220 receives trace parameters 280 from user interface210 and generates trace trigger request 70 from trace parameters 280.FIG. 3 illustrates in greater detail the contents of trace triggerrequest 70, according to a particular embodiment. Management module 220then transmits trace trigger request 70 to one or more tracing nodes 30.Collection module 230 interfaces with tracing nodes 30 and receivestrace report 80 from tracing nodes 30. Collection module 230 transmitstrace reports 80 to analysis module 240. Analysis module 240 correlatestrace reports 80 received from collection module 230 and formats tracereports 80 for presentation to user interface 210.

User interface 210, management module 220, collection module 230, andanalysis module 240 may include any appropriate combination ofcomponents, including hardware and/or software, suitable for providingthe described functionality. Additionally, the functionality describedfor any one or more of user interface 210, management module 220,collection module 230, and analysis module 240 may be provided by sharedor physically integrated components or by the same component or group ofcomponents.

In a particular embodiment, management node 40 includes a computingelement, such as a microprocessor, and user interface 210, managementmodule 220, collection module 230, and analysis module 240 eachrepresent, in part or in whole, software processes running on thecomputing element. As a result, in such an embodiment, the computingelement may provide some or all of the functionality described for eachof user interface 210, management module 220, collection module 230, andanalysis module 240. Furthermore, for the purposes of the descriptionbelow, communication between the various modules may represent passingof values from one software process hosted by the computing element toanother software process also hosted by the same computing element.

Memory 250 stores computer instructions for the modules of managementnode 40, trace parameters 280 input at user interface 210, trace reports80 received by collection module 230, or any other appropriateinformation used by management node 40 during operation. Memory 250 maycomprise any collection and arrangement of volatile or non-volatile,local or remote devices suitable for storing data, such as for examplerandom access memory (RAM) devices, read only memory (ROM) devices,magnetic storage devices, optical storage devices, or any other suitabledata storage devices.

In operation, an administrator or management device of communicationsystem 10 indicates to management node 40 a desire to trace calls byproviding management node 40 with trace parameters 280. Trace parameters280 may represent any appropriate information describing the traceservices requested, such as control protocols to be traced, timeconstraints on the tracing, and/or any other suitable parameters for thetrace. The administrator or management device may provide traceparameters 280 to management node 40 in any appropriate way. Forexample, the administrator may type trace parameters 280 into managementnode 40 using a keyboard of user interface 210, direct management node40 to access stored trace parameters 280 from memory 250, indicate tomanagement node 40 an external storage device on which trace parameters280 are stored, and/or provide trace parameters 280 to management node40 in any other suitable manner.

In response to receiving trace parameters 280, management module 220generates a trace trigger request 70 that includes trace parameters 280.Trace trigger request 70 also includes trace tag 75. Trace tag 75 isused by tracing nodes 30 to mark call signaling messages 50 to betraced. Trace tag 75 additionally describes information to be includedin trace reports 80 sent to management node 40 as a result of tracetrigger request 70. FIGS. 3 and 4 illustrate the contents of tracetrigger request 70 and trace tag 75 in greater detail.

Management module 220 then transmits trace trigger request 70 to one ormore tracing nodes 30. Depending on the configuration of communicationsystem 10, management module 220 may transmit trace trigger request 70to a single predetermined tracing node 30, all tracing nodes 30 incommunication system 10, or one or more tracing nodes 30 determined inany appropriate manner. For example, communication system 10 may includea number of communication subsystems operated by various entities orservice providers. Particular tracing nodes 30 in communication system10 may represent peripheral nodes demarcating a boundary of a particularcommunication subsystem, such as gateways connecting a particularentity's network to a larger multi-entity network, and management module220 may transmit trace trigger request 70 to all such boundary nodes inthe subsystem.

As a result of receiving trace trigger request 70, the receiving tracingnode 30 or tracing nodes 30 begin tracing call signaling messages 50received by that tracing node 30 or those tracing nodes 30 based oninformation included in trace trigger request 70. Operation of tracingnode 30 according to a particular embodiment is described in greaterdetail with respect to FIG. 5. One or more tracing nodes 30 may alsobegin transmitting trace reports 80 that include tag specifiedinformation pertaining to tagged calls to a particular management node40 designated by trace tag 75.

Collection module 230 receives trace reports 80 transmitted tomanagement node 40 by tracing nodes 30. Collection module 230 mayformat, filter, or consolidate trace reports 80 received by managementnode 40 in any appropriate manner and may then transmit trace reports 80to analysis module 240 or may store trace reports 80 in memory 250 forlater use by analysis module 240 or other components of management node40. The contents of trace reports 80 received from various tracing nodes30 may be correlated on a call-by-call or atrace-request-by-trace-request basis by evaluation of a call identifierand request identifier stamped into the logged signaling and diagnosticinformation.

At an appropriate time, analysis module 240 receives from collectionmodule 230 or retrieves from memory 250 one or more trace reports 80.Analysis module 240 may additionally, process trace reports 80, whichmay include aggregating, filtering, formatting, and/or processing tracereports 80 in any other suitable manner. Analysis module 240 thenprovides trace report 80 or portions of trace reports 80 to theadministrator in any appropriate manner. Analysis module 240 may displaytrace reports 80 on a monitor of user interface 210, transmit toadministrator an email or other message containing trace reports 80,output trace reports 80 to the management device through a networkconnection with the management device, or provide trace reports 80 tothe administrator or management device in any other suitable manner.

FIG. 3 illustrates the contents of a particular embodiment of tracetrigger request 70. As indicated above, trace trigger request 70 mayrepresent any form of message or signal appropriate for management node40 to request tracing services from tracing nodes 30. In a particularembodiment, trace trigger request 70 represents an XML message. In theillustrated embodiment, trace trigger request 70 includes trace tag 75and trace criteria 310. Trace tag 75 is used to mark trace callsignaling messages 50 and additionally provides reporting parameters forthe particular tracing node 30 that received the trace trigger request70 and the downstream tracing nodes 30 that subsequently receive tracetag 75 included in tagged call signaling messages 50. FIG. 4 describesthe contents of a particular embodiment of trace tag 75.

Trace criteria 310 provide information that describes to tracing nodes30 the tracing services requested. In the illustrated embodiment, tracecriteria 310 include trace protocol type 320, trace message type 330,trace parameter criteria 340, trace sub-parameter criteria 350, traceevent trigger 360, trace start time 370, trace stop time 380, tracecounter 390, and frequency indicator 400. In a particular embodiment,trace criteria 310 represents an XML element and trace protocol type320, trace message type 330, trace parameter criteria 340, tracesub-parameter criteria 350, trace event trigger 360, trace start time370, trace stop time 380, trace counter 390, and frequency indicator 400represent XML sub-elements.

Trace criteria 310 may specify to tracing nodes 30 calls to be traced.For example, in the illustrated embodiment, protocol type 320 identifiesone or more signaling protocols, such as SIP, H.323, MGCP, SCCP (SkinnyClient Control Protocol or Signaling Connection Control Part), BICC, orNSS, to be evaluated by tracing nodes 30. Trace message type 330specifies particular types of call signaling messages 50 to be evaluatedwithin the identified signaling protocol or protocols. Trace parametercriteria 340 identifies a specific parameter or header and a value forthat parameter or header and instructs tracing nodes 30 to trace callswith the specified value for the specified header or parameter. Tracesub-parameter criteria 350 identifies a specific sub-parameter and avalue for that sub-parameter and instructs tracing nodes 30 to tracecalls with the specified value for the specified sub-header.

Additionally, trace criteria 310 may describe to tracing nodes 30 otherconditions or parameters of the tracing services requested. For example,in the illustrated embodiment, trace event trigger 360 defines an eventor condition, such as the detection of a particular type of alarm or thestorage in call context of a specific destination address falling withina range address trigger, that should initiate the requested tracingservices. Trace criteria 310 also may specify a node type. Tracing node30 may begin performing the tracing described by trace criteria 310 oncethe event specified by trace event trigger has occurred. Trace starttime 370 and trace stop time 380 specify a start and stop time overwhich tracing nodes 30 should perform the tracing. Trace counter 390specifies a total number of calls that should be traced before tracingnodes 30 terminate the tracing services associated with trace triggerrequest 70. Frequency indicator 400 specifies a value N which tracingnode 30 may use to determine the frequency of call tracing. For example,tracing node 30 may trace only every Nth call in order to implementsampling.

FIG. 4 illustrates the contents of trace tag 75 according to aparticular embodiment. Appropriate tracing nodes 30 modify callsignaling messages 50 by adding trace tag 75. Trace tag 75 specifies fortracing nodes 30 downstream from a particular tracing node 30 thatreceived trace trigger request 70 what call information should betraced. As a result, a particular tracing node 30 receiving tracetrigger request 70 may propagate tracing information to downstream nodesby attaching trace tag 75 to call signaling messages 50. Furthermore,downstream tracing nodes 30 report the presence of trace tag 75 in callsignaling messages 50. Thus, trace tag 75 may both mark traced callsignaling messages 50 and also provide information indicating howtracing nodes 30 should report the traced call signaling messages 50.

Trace tag 75 may include any information to facilitate the propagationof tracing information. The illustrated embodiment of trace tag 75includes a unique identifier 410 and a trace scope parameters 430 thatidentify the associated trace trigger request 70 and describe theconstraints of that trace trigger request 70. Additionally, inparticular embodiments, tracing node 30 may incorporate the originaltrace trigger request 70 in trace tag 75 when attaching trace tag 75 tocall signaling messages 50. Furthermore, a particular tracing node 30may incorporate trace report 80 to transmit trace report 80 to a tracingnode 30 that can transmit trace report 80 to management node 40. As aresult, under certain circumstances, trace tag 75 in a particularembodiment may include trace trigger request field 460 and/or tracereport field 470. To control the distance downstream that trace tag 75is propagated, trace tag 75 may also include a time-to-live parameter440.

Unique identifier 410 may represent any combination of information thatallows tracing nodes 30, management node 40 and/or other components ofcommunication system 10 to uniquely identify the trace trigger request70 associated with trace tag 75 and/or the particular management node 40that generated trace tag 75. Unique identifier 410 may includeadditional information to allow management node 40 to distinguishbetween trace tag 75 generated as a result of the same trace triggerrequest 70. In the illustrated embodiment, unique identifier 410includes a call identifier 412, a problem identifier 414, a request time416, a requester identifier 418, a requester domain name 420, and atrace sequence number 422.

Call identifier 412 represents a unique identifier for the tracedinformation associated with a given call. A particular trace report 80specific to a given call may include call identifier 412 to identify thecall that triggered trace report 80. Call identifier 412 may be added totrace tag 75 when tracing node 30 attaches trace tag 75 to callsignaling message 50. If multiple calls meet trace criteria 310, callidentifier 412 may enable management node 40 to sort the multiple tracereports 80 received in response to a single trace trigger request 70.Problem identifier 414 identifies the trace trigger request 70 thatoriginally included trace tag 75. A particular trace trigger request 70may include multiple sets of trace criteria and problem identifier canbe used to identify all of the call traces associated with a given tracetrigger request 70. Request time 416 identifies the time at which thetrace trigger request 70 was generated and allows management node 40 orother components to search or sort trace tags 75 based on the time tracetrigger request 70 was created.

Requestor identifier 418 and requester domain name 420 identify theparticular management node 40 that generated trace trigger request 70.Requestor domain name 420 specifies a fully-qualified domain name (FQDN)for the requesting management node 40 and requester identifier 418provides a unique identifier for management node 40 within the networkassociated with the FQDN. Trace sequence number 422 identifies a numberof branches trace trigger request 70 has taken in traveling the pathand/or specific tracing nodes 30 through which trace trigger request 70has propagated. Additionally, trace sequence number 422 may beincremented to show the branching of trace trigger request 70 throughthe topology. For example, if management node 40 transmits trace triggerrequest 70 to multiple tracing nodes 30, management node 40 may includea different initial value for trace sequence number 422 in each tracetrigger request 70. More specifically, management node 40, in thisexample, may transmit trace trigger requests 70 to three tracing nodes30 and may include an initial trace sequence number 422 of “1000”,“2000”, and “3000” in the particular trace trigger requests 70 sent,respectively, to a first, second, and third tracing node 30. Downstreamtracing nodes 30 may then increment these trace sequence numbers 422(for example, to “1001”, “2001”, and “3001”, respectively). Thus, whenmanagement node 40 subsequently receives trace reports 80 containingthese trace sequence numbers 422, management node 40 may be able todetermine how far trace tag 75 propagated from a particular tracing node30.

As a result of the described elements, in particular embodiments, uniqueidentifier 410 may be problem unique, distinguishing between tracetrigger requests 70; call unique, distinguishing between multiple callstraced as a result of the same trace trigger request 70; temporallyunique, allowing for temporal scoping of views; and spatially unique,distinguishing between requesting management nodes 40.

Trace scope parameters 430 include information defining the scope of therequested tracing services. In general, trace scope parameters 430 mayspecify the parameters of the requested tracing services in anyappropriate manner. In the illustrated embodiment, trace scopeparameters 430 includes protocol stain 432, report protocol 434, reportzone 436, report level 438, and report target 439. Protocol stain 432specifies the protocols for which call signaling messages 50 are taggedby tracing nodes 30. Report protocol 434 identifies the protocols forwhich tracing node 30 will report call signaling messages 50 that aretagged and/or call signaling messages 50 matching trace criteria 310. Asa result, tracing node 30 may receive tagged call signaling messages 50on one layer and report on call signaling messages 50 received on otherlayers. For example, tracing node 30 may receive a tagged call controlmessage 50 on the call control layer, such as a SIP message, thatincludes trace tag 75 with report protocol 434 that identifies a devicecontrol protocol, such as MGCP, for which call signaling messages 50should be reported. Tracing node 30 may then generate trace reports 80for MGCP call control messages 50 received by tracing node 30.

Additionally, depending on the configuration of tracing node 30 and/orthe contents of a particular trace trigger request 70, tracing node 30may tag all, one, or any suitable subset of call signaling messages 50of the protocol specified by protocol stain 432 for a call matchingtrace criteria 310. For example, for a particular call with callsignaling messages 50 that match trace criteria 310, tracing node 30 maytag all call signaling messages 50 that match the protocol of protocolstain 432. For another call with call signaling messages 50 that matchtrace criteria 310, tracing node 30 may tag only the first callsignaling message 50 of the specified protocol that tracing node 30receives for that call. Tracing node 30 may determine which matchingcall signaling messages 50 to tag based on information in trace triggerrequest 70, the configuration of tracing node 30, or any otherappropriate considerations. Similarly, tracing node 30 may generatereports for all, one, or any appropriate subset of call signalingmessage 50 of the protocol specified by report protocol 434 that matchtrace criteria 310 or contain trace tag 75. Tracing node 30 maydetermine which call signaling messages 50 to report based oninformation in trace trigger request 70, the configuration of tracingnode 30, or any other appropriate considerations.

Report zone 436 describes particular zones of communication system 10which are requested to report. Report level 438 specifies a level ofdetail requested for trace report 80. Report target 439 specifies aparticular management node 40 to which trace reports 80 are to betransmitted. As a result, in a particular embodiment of communicationsystem 10 that includes multiple management nodes 40, a first managementnode 40 may transmit trace trigger request 70 that includes reporttarget 439 specifying a second management node 40 to receive tracereports 80.

As noted above, trace trigger request 70 and/or trace report 80 may beincorporated into trace tag 75 to allow tracing node 30 to propagateinformation from trace trigger request 70 or to transmit trace report 80to a tracing node 30 configured to report to management node 40. In theillustrated embodiment, trace tag 75 includes trace trigger requestfield 460. Trace trigger request field 460 may include trace triggerrequest 70, portions of trace trigger request 70, a pointer to tracetrigger request 70, or a link, such as a uniform resource location(URL), to a location where the rest of the trace trigger request 70 canbe downloaded, or any other information describing trace trigger request70. Tracing node 30 may also include a particular trace report 80,portions of trace report 80, a pointer to trace report 80, or a link toa location where trace report 80 can be downloaded, or may referencetrace report 80, in any other appropriate manner, or any otherinformation that describes trace report 80. Additionally, becausemultiple tracing nodes 30 may modify trace tag 75 as the associated callsignaling message 50 traverse communication system 10, trace reportfield 470 may incorporate or reference, for example through links, oneor more trace reports 80 generated by one or more different tracingnodes 30.

Trace tag 75 may also include time-to-live parameter 440. Managementnode 40 may request that trace tag 75 only be propagated a certaindistance downstream. Time-to-live parameter 440 may define the number ofhops that trace tag 75 should be propagated. The Time-to-live parameter440 may be decremented at each tracing node 30 or node 35. Tracing nodes30 may then remove trace tag 75 from call signaling messages 50 oncetime-to-live parameter 440 reaches zero. Alternatively, time-to-liveparameter 440 may be incremented at each tracing node 30 or node 35.Tracing nodes 30 may then remove trace tag 75 from call signalingmessages 50 once time-to-live parameter 440 reaches a predeterminedmaximum.

FIG. 5 illustrates the contents and operation of a particular embodimentof tracing node 30 in greater detail. Tracing node 30 traces informationrequested by trace tag 75 and reports this information to a particularmanagement node 40 specified by trace tag 75. Additionally, tracing node30 may modify particular call signaling messages 50 to propagate tracetags 75 to tracing nodes 30 located downstream. Tracing node 30 includesa management interface module 510, a tagging module 520, a filter module530, a reporting module 550, an erasing module 540, and a call controlmodule 560. Although FIG. 5 illustrates a particular embodiment oftracing node 30 that includes particular components and providesparticular functionality, particular embodiments of tracing node 30 maynot include all components shown. Furthermore, communication system 10may incorporate a number of procedures to compensate for tracing nodes30 that do not support particular functions, as described in greaterdetail below.

Management interface module 510 receives trace activation messages 60and trace trigger requests 70 from management node 40 that intiatetracing services. Call control module 560 receives call signalingmessages 50 from neighboring tracing nodes 30 and nodes 35 and transmitscall signaling messages 50 to the next node downstream in the path ofthat particular call signaling messages 50. Filter module 530 identifiescall signaling messages 50 received by call control module 560 thatmatch trace criteria. Tagging module 520 modifies call signalingmessages 50 identified by filter module 530 by adding trace tag 75.Reporting module 550 reports the receipt of a tagged call signalingmessage 50 to management node 40. Erasing module 540 eliminates tracetags 75 from appropriate call signaling messages 50.

Management interface module 510, call control module 560, filter module530, tagging module 520, reporting module 550, and erasing module 540may each include any combination of components, including hardwareand/or software, suitable for providing the described functionality.Additionally, the functionality described for any one or more ofmanagement interface module 510, call control module 560, filter module530, tagging module 520, reporting module 550, and erasing module 540may be provided by shared or physically integrated components or by thesame component or group of components. In a particular embodiment,tracing node 30 includes a computing element, such as a microprocessor,and management interface module 510, call control module 560, filtermodule 530, tagging module 520, reporting module 550, and erasing module540 each represent, in part or in whole, software processes running onthe computing element. As a result, in such an embodiment, the computingelement may provide some or all of the functionality described for eachof management interface module 510, call control module 560, filtermodule 530, tagging module 520, reporting module 550, and erasing module540. Furthermore, for the purposes of the description below,communication between the various modules may represent passing ofvalues from one software process hosted by the computing element toanother software process also hosted by the same computing element.

Memory 570 stores computer instructions for the functional modules oftracing node 30, trace criteria 310 for filtering call signalingmessages 50, trace tag 75 for tagging call signaling messages 50, tracereports 80 to be transmitted to management node 40 or another tracingnode 30, or any other appropriate information used by tracing node 30during operation. In particular embodiments, memory 570 may alsorepresent portions or all of a buffer 580 used to store informationregarding a state of tracing node 30 and previous states of tracing node30. Memory 570 may comprise any collection and arrangement of volatileor non-volatile, local or remote devices suitable for storing data, suchas for example random access memory (RAM) devices, read only memory(ROM) devices, magnetic storage devices, optical storage devices, or anyother suitable data storage devices.

In operation, tracing node 30 receives trigger activation message 60from management node 40. Tracing node 30 activates tracing functionalityof tracing node 30 in response to receipt of trigger activation message60. As part of activating tracing functionality, tracing node 30 beginsmonitoring for receipt of trace trigger requests 70 by managementinterface module 510 and tagged call signaling messages 50 by callcontrol module 560. As discussed above, in particular embodiments,tracing node 30 may be configured in such a manner that tracingfunctionality is activated by default. In such an embodiment, tracingnode 30 may monitor for trace trigger requests 70 or tagged callsignaling messages 50 regardless of whether tracing node 30 has receivedtrace activation message 60.

Once tracing functionality has been activated, whether activated inresponse to trace activation message 60 or based on a defaultconfiguration, management interface module 510 begins monitoring fortrace trigger requests 70 and any call signaling message 50 containingtrace tag 75. When management interface module 510 receives tracetrigger request 70, management interface module 510 extracts tracecriteria 310 and trace tag 75 from trace trigger request 70. Managementinterface module 510 transmits trace criteria 310 to filter module 530and trace tag 75 to tagging module 520. Filter module 530 and taggingmodule 520 store trace criteria 310 and trace tag 75, respectively, inmemory 570.

When call control module 560 receives call signaling message 50, callcontrol module 560 forwards call signaling message 50 to filter module530. In particular embodiments, filter module 530 filters call signalingmessages 50 by determining, based on parameter values and othercharacteristics of call signaling message 50, whether call signalingmessage 50 matches trace criteria 310. For the purposes of thisdescription, filter module 530 may determine whether call signalingmessage 50 matches trace criteria 310 by determining whether parameters,values, headers, characteristics, properties, or attributes of callsignaling message 50 are equal to, equivalent to, inclusive of, a subsetof, comparable to, within a range specified by, or otherwise match, inany other appropriate manner, one or more of trace criteria 310. A matchmay occur either immediately when node 30 receives a message, or afternode 30 processes the message via mechanisms such as addresstranslation.

In alternative embodiments, only particular tracing nodes 30 aredesignated to perform filtering and only those tracing nodes 30 comparereceived call signaling messages 50 to stored trace criteria 310. Othertracing node 30 may check only for the presence of trace tag 75 in callsignaling messages 50 as described below. For example, communicationsystem 10 may include one or more ingress tracing nodes 30 on theboundary of communication system 10 and other communication systems ornetworks. To limit redundant processing, communication system 10 may beconfigured so that only these ingress tracing nodes 30 filter and tagcall signaling messages 50. Tracing nodes 30 on the interior ofcommunication system 10 may be configured to only check for the presenceof trace tags 75 in call signaling messages 50 and report trace tags 75to management node 40. The remainder of this description, however,assumes that tracing node 30 is configured to filter, tag, and report.

If the received call signaling message 50 matches trace criteria 310,filter module 530 sends call signaling message 50 to tagging module 520.If tracing node 30 has received multiple trace trigger requests 70,filter module 530 may be configured to compare call signaling messages50 to multiple sets of trace criteria 310. If so, filter module 530 mayforward the matching trace criteria 310 with call signaling messages 50or otherwise indicate to tagging module 520 the trace trigger request 70of the matching trace criteria 310.

Tagging module 520 receives call signaling message 50 and identifies aparticular trace tag 75 stored in memory 570 that is associated with thematching trace criteria 310. Tagging module 520 then tags call signalingmessages 50 by attaching the identified trace tag 75 to call signalingmessage 50. For the purposes of this description, “attaching” any typeof information to a message may represent appending the information tothe message, embedding the information within the message, incorporatinga link to the information in the message, generating a new message thatincludes information from the original message and the information to beattached, or associating the information with the message in any otherappropriate manner.

Tagging module 520 then forwards the tagged call signaling message 50,or a copy of the tagged call signaling message 50, to reporting module550. Tagging module 520 may also then return call signaling message 50directly to call control module 560 or to filter module 530 which thenforwards call signaling message 50 to call control module 560.

Reporting module 550 receives the tagged call signaling message 50 andgenerates trace report 80 based on call signaling message 50. Tracereport 80 identifies the particular trace tag 75 included in the taggedcall signaling message 50 that triggered generation of trace report 80,additional information describing the state of tracing node 30, and/orinformation describing how call signaling message 50 was processed bytracing node 30. Additionally, in particular embodiments reportingmodule 550 may access buffer 580 that stores information pertaining toprevious states of tracing node 30 and may include this information intrace report 80. FIG. 6 below illustrates the contents of trace report80 in greater detail. In a particular embodiment, reporting module 550then transmits trace report 80 to management node 40.

In alternative embodiments, tracing node 30 may not be configured totransmit trace reports 80 to management node 40. In such an embodiment,tracing node 30 may instead forward trace report 80 to tagging module520 or another component of tracing node 30. Tagging module 520 or theappropriate component may then attach trace report 80 to call signalingmessage 50 for tunneling to other tracing nodes 30 with reporttransmitting capabilities.

Returning to the operation of filter module 530, if instead callsignaling message 50 does not match trace criteria 310, filter module530 determines whether call signaling message 50 contains trace tag 75.If call signaling message 50 contains trace tag 75, filter module 530transmits a copy of call signaling message 50 to reporting module 550.Reporting module 550 receives call signaling message 50 and generatestrace report 80 based on call signaling message 50. FIG. 6 belowillustrates the contents of trace report 80 in greater detail.

Additionally, if call signaling message 50 contains trace tag 75,filtering module 50 may also determine that, under appropriatecircumstances, removal of trace tag 75 is appropriate. For example, iftracing node 30 is located on the boundary of a particular subsystem,tracing node 30 may be configured to prevent trace tag 75 frompropagating to nodes 35 and tracing node 30 external to the subsystem.If the removal of trace tag 75 is appropriate, tracing node 30 transmitscall signaling message 50 to erasing module 540. Erasing module 540eliminates trace tag 75 from call signaling message 50 and transmitscall signaling message 50 either directly to call control module 560 orback to filtering module for subsequent transmission to call controlmodule 560.

After tracing node 30 has completed any trace-related processing of callsignaling message 50, filtering module 30 transmits call signalingmessage 50 to call control module 560. Call control module 560 performsany appropriate processing on call control module 560, including anytelephony-related processing appropriate based on the protocol andmessage-type of call signaling message 50. Call control module 560 thentransmits call signaling message 50 to the next downstream tracing node30 or node 35.

As noted above, particular embodiments of tracing node 30 may not beconfigured to receive trace trigger requests 70 from management node 40.Additionally, in particular embodiments, tracing node 30 may beconfigured to receive trace trigger requests 70 in call signalingmessages 50. Thus, particular embodiments of tracing nodes 30 that areconfigured to receive trace trigger requests 70 directly from managementnode 40 may also be configured to attach received trace trigger requests70 to call signaling messages 50 to propagate the received trace triggerrequests 70 downstream. Downstream tracing nodes 30 may be able toextract trace trigger requests 70 from received call signaling messages50.

Thus, particular embodiments of tracing node 30 may perform additionalprocessing of call signaling messages 50. Tracing nodes 30 that areoperable to receive trace trigger requests 70 directly from managementnode 40 may attach trace trigger request 70 to call signaling messages50 before transmitting call signaling messages 50 to downstream tracingnodes 30. Any suitable module of tracing node 30 may perform thisprocessing in any appropriate manner. For example, tagging module 520may incorporate trace trigger request 70 to trace tag 75 when attachingtrace tag 75 to call signaling messages 50. Furthermore, tracing nodes30 may be configured to check for trace trigger requests 70 in receivedcall signaling messages 50. If trace trigger request 70 is identified ina particular call signaling message 50, call signaling message 50 may betransmitted to filter module 530. Filter module 530 may then extracttrace criteria from call signaling message 50 as described above.

In a particular embodiment, use of tagging may increase thevulnerability of communication system 10 to distributed denial ofservice (DDOS) attacks because tagging may expose network topology. As aresult, tracing node 30 may additionally perform a number of tasksrelated to system security. For example, tracing node 30 may strip tracetags 75 from call signaling messages 50 received from non-trustedsources. Tracing node 30 may also encrypt trace reports 80 transmittedto management node 40 and may be configured to receive encrypted tracetrigger requests 70 from management node 40 to ensure confidentiality.Moreover, tracing node 30 may perform encryption-based authentication ofcall signaling messages 50 received by tracing node 30. In general,tracing node 30 may perform any appropriate steps to increase securityof communication system 10 in conjunction with performing the describedtracing services.

As a result, particular embodiments of tracing node 30 may provideflexible tracing services. Additionally, particular embodiments mayprovide a method of receiving and propagating tracing information thatallows for integration of tracing node 30 with non-compatible componentswithin communication system 10. Additionally, particular embodiments mayoffer additional features that limit the possibility of unauthorizedparties exploiting trace tag 75 to compromise system security.

FIG. 6 illustrates contents of trace report 80 according to a particularembodiment. When tracing node 30 receives call signaling messages 50with trace tag 75, tracing node 30 may generate trace report 80 toprovide management node 40 the requested diagnostic information for thecall. In the illustrated embodiment, trace report 80 includes a sourceaddress 610 and a timestamp 620 to allow tracing node 30 to determine asource and time at which trace report 80 was generated. Additionally,depending on the configuration of communication system 10, trace report80 may also include any appropriate information to allow management node40 to determine the state of the reporting tracing node 30, of othercomponents in communication system 10, or of the traced call signalingmessage 50 at the time tracing node 30 generated trace report 80. Forexample, in a particular embodiment, trace report 80 includes trace tagfield 630, message fields 640, and/or context data 650, as describedbelow.

Source address 610 identifies the tracing node 30 that represents thesource tracing node 30 that generated trace report 80. Source address610 may include any form of address or other identifier suitable for usebased on the configuration and characteristics of communication system10. In a particular embodiment, source address 610 specifies a platform,sub-system, and module that generated trace report 80. Additionally, inparticular embodiments of communication system 10, particular tracingnodes 30 may not support the transmission of trace reports 80 tomanagement node 40. As a result, these tracing node 30 may insteadattach trace reports 80 to call signaling messages 50 to tunnel tracereports 80 to tracing nodes 30 that do support transmission tomanagement node 40. Thus, source address 610 may not identify thetracing node 30 from which management node 40 received trace report 80,but instead the tracing node 30 that initially generates trace report80.

Timestamp 620 identifies the time at which trace report 80 wasgenerated. Timestamp 620 may identify the time as an absolute measure oras a time value relative to some reference time. For example, in aparticular embodiment, timestamp 620 may identify the time of generationrelative to the time when trace trigger request 70 was issued.

As noted above, trace report 80 may provide information pertaining tothe state of the reporting tracing node 30, of other components incommunication system 10, or of the traced call signaling message 50. Forexample, in a particular embodiment, trace report 80 includes trace tagfield 630, signaling message field 640, and context data 650. Trace tagfield 630 includes a copy of the particular trace tag 75 that triggeredtrace report 80, portions of that trace tag 75, a pointer to trace tag75, or a link to a location where trace tag 75 may be downloaded, or mayincorporate into trace tag field 630, in any other appropriate manner,information from the relevant trace tag 75.

Signaling message fields 640 may comprise a trace of call signalingmessages 50 received by tracing node 30 that are of the protocol orprotocols specified by trace tag 75. Each signaling message field 640may include a copy of a matching call signaling message 50, portions ofthat call signaling message 50, a pointer to that call signaling message50, or a link to a location where that call signaling message 50 may bedownloaded, or may incorporate into trace tag field 630, in any otherappropriate manner, information from the relevant call signaling message50. Additionally, signaling message field 640 may include call signalingmessage 50 or information from call signaling message 50 in the form inwhich call signaling message 50 is received, output to downstreamtracing nodes 30, or transmitted to ancillary components, such as amedia processing server, for service. Thus, trace report 80 may or maynot reflect changes to call signaling message 50 made by the reportingtracing node 30, depending on the configuration of communication system10 and/or the parameters of trace trigger request 70.

Context data 650 may describe a state of tracing node 30 when tracingnode 30 received call signaling messages 50 or a log of multiple statesof tracing node 30 before or after receipt of call signaling messages50. For example, context data 650 may describe a sub-component thatprocessed call signaling message 50, whether the processing wassuccessful, and/or any exception handling of call signaling message 50.Context data 650 may describe alarms, events, state changes, loggedrecords, and/or session detail records associated with the relevanttrace tag 75. The amount of detail included in context data 650 may bedetermined by report level 438 of trace tag 75 that triggered tracereport 80. Additionally, as described above with respect to FIG. 5,tracing node 30 may include a circular buffer that allows tracing node30 to store and report information about the state of tracing node 30prior to receipt of the relevant call signaling message 50. As a result,context data 650 may also include information describing a prior stateof tracing node 30.

Although FIGS. 3, 4, and 6 illustrate, respectively, contents of tracetrigger request 70, trace tag 75, and trace report 80 as utilized by aparticular embodiment of communication system 10, communication system10 may be configured to use any suitable form of trace trigger request70, trace tag 75, and trace report 80 containing information appropriatefor the operation of that particular embodiment of communication system10 and structured in any appropriate manner. For example, although theabove description illustrates an embodiment of tracing node 30 thattunnels trace trigger request 70 and trace report 80 as fields withintrace tag 75, in a particular embodiment of communication system 10,tracing node 30 may attach to trace trigger request 70, trace tag 75,and trace report 80 to call signaling message 50 as separate fields ordata objects of call signaling message 50. As another example, tracingnode 30 may attach a single data object to call signaling message 50that includes a separate field containing trace trigger request 70,trace tag 75, and trace report 80.

FIG. 7 is a flowchart illustrating operation of a particular embodimentof tracing node 30 in receiving trace activation messages 60 and tracetrigger request 70. In the described embodiment, tracing node 30 isassumed to be capable of receiving trace trigger request 70 directlyfrom management node 40 and propagating trace tags 75 and tunnelingtrace trigger request 70 to downstream tracing nodes 30 by way of callsignaling messages 50. For the sake of simplicity, tracing node 30 isillustrated as maintaining only one set of trace criteria 340 at a time.Alternative embodiments of tracing node 30 may utilize any appropriatenumber of trace criteria 340 contemporaneously. Additionally, managementnode 40 is assumed to allow existing trace criteria 340 in tracing node30 to expire before deactivating trace functionality. In alternativeembodiments of communication system 10, management node 40 may becapable of canceling existing trace trigger requests 70 by transmittinga trace deactivation message to tracing node 30 before trace triggerrequest 70 expires.

At step 710, tracing node 30 receives trace activation message 60. Inresponse to trace activation message 60, tracing node 30 activatestracing functionality of tracing node 30 at step 720. At step 730,tracing node 30 determines whether tracing node 30 has received tracetrigger request 70. If not, the process continues at step 770. Iftracing node 30 has received trace trigger request 70, tracing node 30extracts trace tag 75 and trace criteria 340 from trace trigger request70 and stores trace tag 75 and trace criteria 340 for subsequent use atstep 740.

Tracing node 30 then begins tracing calls by comparing call signalingmessages 50 to trace criteria 340 and tagging matching call signalingmessages 50 with trace tag 75 at step 750. This process is illustratedin greater detail in FIG. 8. At step 760, tracing node 30 determineswhether trace criteria 340 stored by tracing node 30 has expired. Iftrace criteria 340 has not expired, tracing node 30 continues matchingcall signaling messages 50 to trace criteria 340, returning to step 750.

If trace criteria 340 has expired, tracing node 30 determines whethertracing node 30 has received a trace deactivation message at step 770.If tracing node 30 has not received a trace deactivation message, theprocess returns to step 730. If tracing node 30 has received adeactivation message, tracing node 30 deactivates tracing functionalityof tracing node 30 at step 780.

FIG. 8 is a flowchart illustrating operation of tracing node 30 inprocessing call signaling messages 50. FIG. 8 illustrates operation oftracing node 30 after tracing node 30 has activated tracingfunctionality and has received trace criteria 340 as part of a tracetrigger request 70.

At step 810, tracing node 30 receives call signaling message 50. At step820, tracing node 30 performs appropriate call control functions. Atstep 830, tracing node 30 determines whether call signaling message 50matches trace criteria 340. If call signaling message 50 does not matchtrace criteria 340, tracing node 30 proceeds to step 920.

If call signaling message 50 does match trace criteria 340, tracing node30 determines whether to pass trace criteria 340 to one or moredownstream tracing node 30 at step 840. If tracing node 30 decides topass trace criteria 340 to one or more downstream tracing node 30,tracing node 30 attaches trace criteria 340 to trace tag 75 at step 850.

At step 860, tracing node 30 generates trace report 80. At step 870,tracing node 30 determines whether tracing node 30 is configured totransmit trace report 80 directly to management node 40. If so, tracingnode 30 transmits trace report 80 to management node 40 at step 880. Ifnot, tracing node 30 attaches trace report 80 to trace tag 75 at step890.

At step 900, tracing node 30 determines whether to attach trace tag 75to call signaling message 50. A particular embodiment of tracing node 30may be configured to only report on call signaling messages 50 thatmatch trace criteria 340 and not to tag matching call signaling messages50. If tracing node 30 decides to tag call signaling message 50, tracingnode 30 attaches trace tag 75 to call signaling message 50 at step 910.

At step 920, tracing node 30 may perform additional call controlfunctions with respect to call signaling message 50. At step 930,tracing node 30 then transmits call signaling message 50 to downstreamtracing node 30.

Although the present invention has been described with severalembodiments, a myriad of changes, variations, alterations,transformations, and modifications may be suggested to one skilled inthe art, and it is intended that the present invention encompass suchchanges, variations, alterations, transformations, and modifications asfall within the scope of the appended claims. For example, manyprotocols support an informational type of signal. A particularembodiment of tracing node 30 may be configured to propagate tracetrigger request 70 and trace report 80 as a no-op information signal inorder to send trace trigger request 70 and trace report 80 independentlyof the protocol's normal signaling.

1. A method for tracing communications, comprising: receiving trace criteria from a first remote element; receiving a call signaling message from a second remote element; determining whether the call signaling message matches the trace criteria; attaching a trace tag to the call signaling message, if the call signaling message matches the trace criteria; and transmitting the call signaling message to a third remote element.
 2. The method of claim 1, wherein determining whether the call signaling message matches the trace criteria comprises: receiving the call signaling message; and determining whether the call signaling message matches the trace criteria.
 3. The method of claim 1, wherein determining whether the call signaling message matches the trace criteria comprises: generating the call signaling message; and determining whether the call signaling message matches the trace criteria.
 4. The method of claim 1, wherein receiving the trace criteria comprises receiving a trace trigger request from a management node that includes the trace criteria.
 5. The method of claim 4, wherein attaching the trace tag comprises attaching the trace tag and the trace trigger request to the call signaling message.
 6. The method of claim 1, wherein the call signaling message comprises a first call signaling message, and wherein receiving the trace criteria comprises receiving the trace criteria in a second call signaling message received before the first call signaling message.
 7. The method of claim 6, wherein receiving the trace criteria in the second call signaling message further comprises receiving information specifying a location of the trace criteria in the second call signaling message.
 8. The method of claim 1, further comprising: generating a trace report if the call signaling message matches the trace criteria; and transmitting the trace report to a remote element.
 9. The method of claim 8, wherein receiving the trace criteria comprises receiving the trace criteria in a trace trigger request from a management node, and wherein transmitting the trace report further comprises transmitting the report to the management node.
 10. The method of claim 8, wherein receiving the trace criteria comprises receiving the trace criteria in a trace trigger request from a first management node, and wherein transmitting the trace report further comprises transmitting the report to a second management node specified by the trace trigger request.
 11. The method of claim 8, wherein transmitting the trace report to a remote element comprises attaching the trace report to the call signaling message.
 12. The method of claim 8, wherein transmitting the trace report to a remote element comprises attaching information that specifies a location of the trace report to the call signaling message.
 13. The method of claim 1, wherein determining whether the call signaling message matches the trace criteria comprises: determining whether a trace activation message has been received; and determining whether the call signaling message matches the trace criteria if the trace activation message has been received.
 14. A device for tracing communications, comprising: a management interface module operable to receive trace criteria from a first remote element; a call control module operable to receive a call signaling message from a second remote element; a filter module operable to determine whether the call signaling message matches the trace criteria; and a tagging module operable to attach a trace tag to the call signaling message, if the call signaling message matches the trace criteria, wherein the call control module is further operable to transmit the call signaling message to a third remote element.
 15. The device of claim 14, wherein the device is further operable to receive the call signaling message.
 16. The device of claim 14, wherein the device is further operable to generate the call signaling message.
 17. The device of claim 14, wherein the management interface module is operable to receive the trace criteria by receiving a trace trigger request from a management node that includes the trace criteria.
 18. The device of claim 17, wherein the tagging module is operable to attach the trace tag by attaching the trace tag and the trace trigger request to the call signaling message.
 19. The device of claim 14, wherein: the call signaling message comprises a first call signaling message; the call control module comprises the management module; and the management module is operable to receive the trace criteria by receiving the trace criteria in a second call signaling message received before the management module receives the first call signaling message.
 20. The device of claim 19, wherein the management module is further operable to receive the trace criteria in the second call signaling message by receiving information specifying a location of the trace criteria in the second call signaling message.
 21. The device of claim 14, further comprising a reporting module operable to: generate a trace report if the call signaling message matches the trace criteria; and transmit the trace report to a remote element.
 22. The device of claim 21, wherein the management module is operable to receive the trace criteria by receiving the trace criteria in a trace trigger request from a management node, and wherein the reporting module is operable to transmit the trace report by transmitting the report to the management node.
 23. The device of claim 21, wherein the management module is operable to receive the trace criteria by receiving the trace criteria in a trace trigger request from a first management node, and wherein the reporting module is operable to transmit the trace report by transmitting the report to a second management node specified by the trace trigger request.
 24. The device of claim 21, wherein the reporting module is operable to transmit the trace report to a remote element by attaching the trace report to the call signaling message.
 25. The device of claim 21, wherein the reporting module is operable to transmit the trace report to a remote element by attaching information that specifies a location of the trace report to the call signaling message.
 26. The device of claim 14, wherein the filtering module is operable to determine whether the call signaling message matches the trace criteria by: determining whether a trace activation message has been received; and determining whether the call signaling message matches the trace criteria if the trace activation message has been received.
 27. A computer product comprising executable instructions stored on a computer readable medium, the executable instructions operable, when executed, to: receive trace criteria from a first remote element; receive a call signaling message from a second remote element; determine whether the call signaling message matches the trace criteria; attach a trace tag to the call signaling message, if the call signaling message matches the trace criteria; and transmit the call signaling message to a third remote element.
 28. The computer program of claim 27, wherein the computer program is operable to determine whether the call signaling message matches the trace criteria by: receiving the call signaling message; and determining whether the call signaling message matches the trace criteria.
 29. The computer program of claim 27, wherein the computer program is operable to determine whether the call signaling message matches the trace criteria by: generating the call signaling message; and determining whether the call signaling message matches the trace criteria.
 30. The computer program of claim 27, wherein the computer program is operable to receive the trace criteria by receiving a trace trigger request from a management node that includes the trace criteria.
 31. The computer program of claim 27, wherein the computer program is operable to attach the trace tag by attaching the trace tag and the trace trigger request to the call signaling message.
 32. The computer program of claim 27, wherein the call signaling message comprises a first call signaling message, and wherein the computer program is operable to receive the trace criteria by receiving the trace criteria in a second call signaling message received before the first call signaling message.
 33. The computer program of claim 32, wherein the computer program is further operable to receive the trace criteria in the second call signaling message by receiving information specifying a location of the trace criteria in the second call signaling message.
 34. The computer program of claim 27, wherein the computer program is further operable to: generate a trace report if the call signaling message matches the trace criteria; and transmit the trace report to a remote element.
 35. The computer program of claim 34, wherein the computer program is further operable to receive the trace criteria by receiving the trace criteria in a trace trigger request from a management node and to transmit the trace report by transmitting the report to the management node.
 36. The computer program of claim 34, wherein the computer program is operable to receive the trace criteria by receiving the trace criteria in a trace trigger request from a first management node and to transmit the trace report by transmitting the report to a second management node specified by the trace trigger request.
 37. The computer program of claim 34, wherein the computer program is operable to transmit the trace report to a remote element by attaching the trace report to the call signaling message.
 38. The computer program of claim 34, wherein the computer program is operable to transmit the trace report to a remote element by attaching information that specifies a location of the trace report to the call signaling message.
 39. The computer program of claim 34, wherein the computer program is operable to determine whether the call signaling message matches the trace criteria by: determining whether a trace activation message has been received; and determining whether the call signaling message matches the trace criteria if the trace activation message has been received.
 40. A system for tracing communications, comprising: a management node operable to transmit a trace trigger request to one or more remote elements; and a tracing node operable to: receive a trace trigger request from the management node, the trace trigger request comprising trace criteria; receive a call signaling message from a first remote element; determine whether the call signaling message matches the trace criteria; attach a trace tag to the call signaling message, if the call signaling message matches the trace criteria; and transmitting the call signaling message to a second remote element.
 41. The system of claim 40, wherein the tracing node is further operable to receive the call signaling message.
 42. The system of claim 40, wherein the tracing node is further operable to generate the call signaling message.
 43. The system of claim 40, wherein the tracing node is operable to attach the trace tag by attaching the trace tag and the trace trigger request to the call signaling message.
 44. The system of claim 40, wherein the tracing node is further operable to: generate a trace report if the call signaling message matches the trace criteria; and transmit the trace report to a remote element.
 45. The system of claim 44, wherein the tracing node is operable to transmit the trace report by transmitting the report to the management node.
 46. The system of claim 44, wherein the management node comprises a first management node, and wherein the tracing node is operable to transmit the trace report by transmitting the report to a second management node specified by the trace trigger request.
 47. The system of claim 44, wherein the tracing node is operable to transmit the trace report by attaching the trace report to the call signaling message.
 48. The system of claim 44, wherein the tracing node is operable to transmit the trace report by attaching information that specifies a location of the trace report to the call signaling message.
 49. The system of claim 40, wherein the tracing node is operable to determine whether the call signaling message matches the trace criteria by: determining whether a trace activation message has been received; and determining whether the call signaling message matches the trace criteria if the trace activation message has been received.
 50. A system for tracing communications, comprising: means for receiving trace criteria from a first remote element; means for receiving a call signaling message from a second remote element; means for determining whether the call signaling message matches the trace criteria; means for attaching a trace tag to the call signaling message, if the call signaling message matches the trace criteria; and means for transmitting the call signaling message to a third remote element. 